CVE-2024-55892CWE-601

Potential Open Redirect via Parsing Differences in TYPO3

Medium · published January 14, 2025

CVSS v3.1
4.8
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a query parameter) and validate the host of the parsed URL may be vulnerable to open redirect or SSRF attacks if the URL is used after passing the validation checks. Users are advised to update to TYPO3 versions 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 LTS, 12.4.25 LTS, 13.4.3 which fix the problem described. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2025-01-14T20:01Z
EPSS history
Timeline
  • 14 JAN 20:01Z
    Potential Open Redirect via Parsing Differences in TYPO3
    cvelistv5